ШЕЕ 
ИШШШШ 000 


Dan Kaminsky 


ШОПЕН 
White Ops 


Ε.Ε 
* ПП DEFCON ΠΠΠΠΠΠΠΠΠΠΠΠΗ 


° ПО0000 DEFCON UUUUUUU DEFCON UUUUUUUUUD 
ΕΕ 


νε 


° 41 ΕΕ Ε ΕΕ ΕΕΕΕΕΕΕΕΕΕΕΕΗΕΕ 


HOOL 
* 0000000000000000000 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΒΕ ΕΡΕ ΕΕ ΕΕ 
° 41 ո ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕ 


° ПШОНО 
ΗΕ 
"ՄՊԼ ա Լլ 
DUOUUDOUUUUUDD 


60 ПОП 


ΕΕ ΕΕ ΕΕ ШШШ 
ΕΕ ΕΕ ԱԼ 
”UUUUUUUUUUU 60 ШП 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕΕΕ 


- ООООООООООО 
-DOUUUUUUUUUUUUU 60 DUUUUUUUUUDU 
° 00000 60 ПП 


“ΠΠΓΠ 60 0000”. 
100000 


L3400U0UUUUUUUUUUUUUUUUUU 
ΕΕ ΕΕ ΕΕ 


Ol са НЬ. — el ee 


European clocks lose six minutes after 
dispute saps power from electricity grid 
00000000000000000000000 


A row between Kosovo and Serbia is draining energy from the 
continent’s 25-nation system, causing electronic clocks to fall behind 


0000000000000000000 25 000000000000000000 


UUUDOUUUOUUDOUDODDDODDDD 


UUUDOUUUOUUDODDD 
OOOO = OOL 


Պ 


° 0000000 50 D] 60 ПП 
UUUUUUUUUUUU 19 0 
1 90 00000000 133 
UUUDOUUOUUDODD 


° III IILI I! 
UUUDOUUUOUUDODDD 


ΕΕ ΕΕ ΕΕ 


JUUUUUUUUDUUUUDUL 
` 00000000000 


а“ 00000 25 П 100 00000000 
A ° 00000, 0000000000: 


~ 60 fps = ΠΗΠΠ 

- 60 fps = ΠΠΠΠΠΠΠΠ 

- 60 fps = ΠΠΠΠΠΠΠΠΠΠ 

~ 60 fps = ΠΠΠΠ/ΠΠΠΠΠΠΠΠΠΠΠ :) 


ЕНЕШЕ 
* 0000000000000004 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΗΕ 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΒΕ ΕΕΕΕΕΕΕΕΕΕΕ ΕΕΣ 
° OORO root ППППППП root” 


С 


m 


° 000 Spectre 10000 Meltdown р 


° ШШШШШ 
00000000" 
"000" 


00000007 
"000" 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ TETTE TC III 
° 000000000 15.6 0000000000... 


1000[]]/15.6[]] Հ 64 | OL 


ΕΕ 


° ООООО 


ΕΕ ΕΕ ΕΕ ΕΕ. 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕΕΕΕ 
ΕΕ ΕΕΕΕΡΕΕ 


ΗΕ 


spectre П Meltdown [ULL 


° 1) 00000000000 
DODUDDUDUDODDUDUODUODUUDUUD 
DUOUUUUUUUODUDU2ODOUUUDUDDDD 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ О0000000000000000 
ΕΕ ΕΕΕΕΕΕΕΕΗΕ 


- 07 ΕΠΕ ΕΕΕΕΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ոնն ըը 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΡΕ ΕΕΣ 


Spectre [] Meltdown ПЕР 


- 2) 0000000000000000000 

- ΠΠ is Ring 0 and DODO is Ring 3" 
“102 00000? 000 
* (00000000000) 

> Աա ԱԼ 11111111 111 


° 0U00000000000000000000000000000000000000004 
UUUUUUUUUDD 


° մ ա 1 Լլ ԼԱ 11111111 11111111... 


Ε.Ε. 


ΕΕ ΕΕ ΕΕ 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ Ε ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕ ΕΕ 


spectre Π Meltdown DUUUULUUUUUUUUUUUD 
UUUUUUUUUUOUUDODDODD 


ΠΗΗΠΙΗΗΗΠΙΗΗΗ 


UUUUUUUU U OUUUUUD 
UUUUUUUUUUU CFUUUUUUUUU O” ПОП 
UUUUUUU О000000000000000000 

ПЕЕ 


ОООО ОООО ООО 


PE 


° “ 2000000000000 DUOUUUUUUUUUUUUUUUUUUUUUUUUD 
ΗΠΠΠΗΠΗΗΗΠΗ 

“ΗΠΠΠΗΠΗΗΗΠΗΗΗΠΗΗ 

” DUUDUUD 


- ΗΠΠΗΠΗΗΠΗΗΠΗΗΠΗΠΗ 
 (000000000000000000000000) 


° 100000000000000000000000 00 
- 0000000000“ Heh, ML really helps with prefetching!” 


ПЕШЕНЕ 


”DUOUUUUUUUUDOUUUUUUUUDODODDDO 

ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕΕ 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ OUOU” 

ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕΕ 


° III II 

- ΗΗΠΗ 

ΕΕ 

- ΗΗΠΗΗΠΠΗΗΠΗΗ 

- ΗΗΠΗΗΠΗΗΗΠΗΗΠΗΗΗ 


UUUUOUUOOUDODD 


1 11 11 11111 
UUUDUUUUUUUOOUDODDDD 


Nano-Pi Neo 
$20. ПП. ППП 


Extremely tiny, Lots of fun. 
Smaller than Oreo Cookie, Faster than Raspberry Pi 


44*44mm 


40* 40mm 


= @ @ @ 


ortex A53 512MB 10/100/1000M Linux 4.16 USB 2.0*3 size 
G й ac uad cc ore DDR3 RAM Ethernet 40*40mm 
jit 


JUUUUULUUUUUUDUUUUE 


”UUUUUUUUUUUUUUUUUDD 
- 00000 00, ШІП 
° III HI! 


~” 00000000000000000000000000000000000000000, ПО HPC 0000 
OOOO 


- 000000000000000000 НРС 00000, П Kitten, MoS, Rump Kernels 
ΠΠ HermitCore, LKL (0000 Linux) 


- 00000000000000000°000700 


- 00000000 Spectre/Meltdown О0000000000000000000000000000 
OOOO 


- “00000000JavaScript 0000000” 


1 ΕΕ ΕΕΣ 


° ПОШУ 
° DDUUDUU 
”DUOUUUDOUUOUUDODDODDDODDDD 


© “ O0000000000000000 Spectre/Meltdown ПП 


UUUUUUUUUUUUUUUUUUUUUUUUUUUU 00000 “ 
|| 


1 ΕΕ ΕΕΣ 


• 000000000000000000000000 / O000000000000 | 


° 00000000000004 


° ΠΠ О0000000000000О“ QU ШИШИП 


° IL IILI IILI IILI III III LIL III! 
ПП 


”UUUUUUUUUUUU 一 一 UUUUUUUUUUUUUOUUUUDOUUUOODDDD 
[| 


- DODUDUDUOD... 


ΕΕ ΕΕ ΕΕ 


ΕΕ ΕΡΕ 
ΕΕ... 


000 (111111 


ΕΕ 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕ. 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕ ΕΕ, 


ΕΕ ΕΕ ΕΕΕΕΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΡΕ 
ΕΕ... 


ΠΗ 


1 11 11 ԼԼ 
ΗΕ 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕΕΕ 
1111... 


Dev vs. Test 


ШІ 


° 007 00000000 
ΕΕ ΕΕ ΕΕ III I! 


° IILI IILI IL 
- DIII IILI III IILI IIT 


UUDUUDOUDD 
" 00000000000000 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ШИШИП ШИШ 
ΠΗ 


 — 


° IILI IILI III III 


 U000000000000 0000 
ΕΕ ΕΕ 
° 0U0000000000000000 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ 


Ε.Ε. 


° Fortran UUUUUUUUUUUUD 
Python ΠΠΠΠΠΠΠΠΠΠΠΠΠΠ 


00000 Numba 
- 000000000000000000000 Python 000000000 CPU/GPU ը 
ПО 


-UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUDD 


- ΗΗΠΠΗΗΠΗΗΗΠΗΗΠΗΗΗΠΗΗΠΗΗΠΗΗΗΠΗΗΠΗΙΗΗΠΗΗΠΗΗΗΠΗΗΠΗΗ 
-ΠΠΠΠΠΗΠΠΠΠΠΠΠΠΠ СМЕ 000 
 0000000000000000000000000 


| ES 
° Python (110100000000000000000000000000 
ΕΕ ΕΕ 
a ΕΕ ΕΕΕΕΕΕΕΕΕΕΕΕ ΕΕ ID IC TC TEIL TC IC JC TDI ԱԱ ԼԼ 
DEL] 


11111 
• Dropbox ППП PyAnnotate 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ Л ЛЛ 
° 000000000000 Numba 000000000 


”DUOUUULOUUOUUDOUDODUDODDODDDODDODD 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΚ 


111 (1111 


° DUOUUUUUUU PGO ПП“ 
-DUOUUUUUUUUUUD 
DUOUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUDD 


ΕΕ ΕΕ ΕΕ 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ. 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕΕ 
ПП 


- А) 00000000000 
- B) ΠΠΠΠΠΠΠΠΠ 


 -— 


ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕ ΕΕ 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕ 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ НО 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΡΕ 


ΕΕ ԼԱԼ. 
* 00000“00”0000000000000000 


- DIII III LI III III 


-DUOUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU C+ 
+UUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUD 
անի 


A “ 000000000000000000000000077000000000 


UUUDUDUUUUUUOOUDOUDOUUDODDODDDODDODDD 
ΗΕ 


111 (1111 


| 


" 1) 00000000 
”UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUDD 
UUUUUUUUUUUUUUUUUUD 
-DUOUUUUUUUUUUUUUOUUUUODDODDDDD 
-DUOUUUUUUUUUUUUUOUUUUOUOUDOOUDUUOUUUODDDDDD 
՞ 000000000 Gentoo 0000 
ЕНЕ 
- (Ubuntu ПП apt-build ПО0000000000000000000 


° [III 
ΕΕ ΕΕ ΕΕ 
 OU0000000000000 
ΕΕ ΕΕ III! 


° ПОШО 
ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕΕΕ 
ΕΕ ΕΕ ΕΕ ΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕ 
° Ш" 


° 00000000 дарди! 


sudo ПП 


“DUOUUUUUUrootUUUUUUUUUUUUUUUUUUUUOUDD 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ root ΠΠ 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ root 00 
ΕΕ ΕΕ ΕΕΚ ΟΕΕ ΕΕΒΕ ΕΕ ΕΕ ΕΕΒΕ ΕΕ root [0000000 
- Wireshark 0000 


° 00000 va 000000 (000000 USB 0000000) 
”UUU0UU2>B (0 root 000 lua 00000000 ) 
° 0000000000 
- 00000000000000000000 
° 000000000000000 
° 0000000000000000000000000000000000 


- 000000000000000000 Defcon (0000000 


Arrow keys navigate the menu. «Enter» selects submenus ---> (or empty 
submenus ----). Highlighted letters are hotkeys. Pressing «Y» 
includes, «N» excludes, «M» modularizes features. Press «Esc»«Esc» to 
exit, «?» for Help, «/» for Search. Legend: [*] built-in [ ] 


--- Configure standard kernel features (expert users) 


Ս 


[ | getmask/ssetmask syscalls support 
[*] ysfs syscall support 
[2:21 ysctl syscall support 
[*] osix Clocks & timers 
[*] oad all symbols for debugging/ksymoops 
ЕШ nclude all symbols in kallsyms 
[*] nable support for printk 
[*] UG() support 
*) 


< Exit > « Help » « Save » < Load > 


տ 


УУ) 
ЕА 
у 


ն 24425: 
299999890004: 
1999099008088 
% 44422220: 
4% 1494505 4 
M мац; 


ՀԱՆԵՆ» 
TA 


Ха 


UUUUDDD 
000000000“ - 


44 


UUUUUU sudo ПОП 


ШШ 
”UU00UUUU0UUU00U sudo ΠΠΠΠΠΠΠΠΠ 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ԼԼ ԼՈ 
- ΗΗΠΗΗΗΗΠΗΗΗ 


”UUUOUOOOUUUUUUUUUD 
- 000000 root 
- HUUL root 
- Kali Linux 0000000 root 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΒΕ ΕΕ ΕΕ Јаруќег ПОО00000000000000 
00000000000000000 root UUUUUUUUUUUUUUUUUUU UUU Python” 


Լ ԼԼ. 
• 0000000 root О00000000000000000000000 
“00000000” 


° III III III IE TC TL JL TL JE TC ԼԼ 


”DUOUUUDOUUOUUOOUDODDDODDODDODDDODDODD 
ППИПИПИПИПИПИП The Prompt 0000000000 


ΗΠΠΠΗΠΗ......ΗΠΡΠΠΗΗΠΗΙΗΗΗΗΗΗ 


UUUUUUUUDU root 


The One Droid 


° 000 linux 000 USB 00000000000 

- USB 000 

”UUUUUUUUUUUUUUUUUUU USB-C 0 USB 3.1 ПП 
”"UUUUUUUUUUUUUUUUU РС О000000 


՞ HLI! 

° ШШШ? 

- 1) ΠΗ 

- 2) ΠΠΠΠΗ (UEFI 0000000) 

՞ 3) 00 (00000000000000) 

- 4) ПП (USB 000000000000000000000000000 
- 5) 00000000000 00000000. 000000000000000000000000 . 


HOOL 


”DUOUUUUUUUUUUUUUUUU ? 
ΗΠΠΠΗΠΗΗΗΠΗΗΗΗ 
ΕΕΣ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ? 0000000000000 * 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ОО0000000000000000000000 * 


ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ԼԱԼՈՎ ԼՈՎ ԼԱԼԱՆ. 
ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ ΕΕ О0000000000000000 


Ud УМ ПО 


° 0000000 , ШШ 
- 00000 100 0000000000000000 (ΠΠ, Criu) 
° Baremetal [111000000000000 
DUOUUUUUUUUUUUUUUUUUUUUUUUUDD 
° III III, 90000 
”~ ΗΗΗΗΠΗΗΠΗΗΠΗΠΗΗΗΗΗΠΗΗΗ 


- 00000000, mmap(MAP PRIVATE) 0000000 рс.гат, Ц 
00000000000000 hyper.sh 00000000 
ΕΕ ΕΕ ΕΕ III II 


OUUU HOWTO 


• Hyper.sh ПП 
- (000000000000000000000000000) 
- VM's (qemu) ППП guest main memory, 000000 Memory (ПП 
guest main ППП) 


- Qemu [|] guest main memory (000000 
* -object 
memory-backend-file,id=smem,size=128G,mem-path=/dev/shm/linux 
_memstate,share=on -numa node,cpus=0-1,memdev=smem 


* 00000. libvmi / vmidbg 
~ Hyper.sh ΠΠΠΠΠΠΠΠΠΠΠΠΠ, 0000000 


° 020000000000 
° OOhttps://autoclave.runf]000 - 0000 CoW maps 


0000 · 


° DDUUDDUU 

° [IILI 

"Uu: 0О00000000 ΠΠΗΙΗΗΗΠΗΗΗΗΗ 
”https:/autoclave.runUUUUUUUUUUUU , 00000 


° 0000 gvisor 00000000 СП Hyper 0 2), 0000 
UUUUUUUDOD 


՞ OU0U00000000000000 005 


0000 2 
* Mmap 00000000000 


° О Linux DIDIDOEIDIBIEIIDIE UUUUUUUUUU RAM 000000 
ПП 0000 memcpy f] 
- 009000000000 memfa Г 


— 


”DUUUUUUUUUUUUUUUU (ШШ) 00000 (00). 


° Fork() 000000000 


° Qemu О00000 (00000, 00000 
MADV DONTFORK). 


00/00 
• [|] 2 ПП (raise, 0, 0, SIGSTOP); 


- ΗΗΠΠΗΠΗΗΗΠΗΗΠΗΙΗΗΠΗΗΠΗΙΗΗΠΗΗΠΠΗ 
000000 (00000000000000000) 0 


”DUOUUULOUUOUUDODDODDDODDDD 


° 00, 000000 /proc/$pid/maps 00000000. ΠΠ 
ПО splice ПП vsplice 00000 


ШІ 


ΕΕ ΕΕ 
ΕΕ ΕΕ 


° ОООООО , ΠΗ, ΠΗ, ΕΕ ΕΕΕΕΕΕΕΕΕΕΕΕΝΕΕΗΕ 
00000000 <0000000000000000 ) 


° 00000 ! 


| A Ge —— —— —— ———XA— !"€—X M—À | 


———————— 


-一 一 | 一 一 | 一 | 一 一 一 | 一 一 一 | 一 一 一 人 一 一 人 


